SQL Express sa login messages

**iminore** · #1 (**permalink**) 24-11-2008, 16:32

I've got SQL Express on a Windows 2003 server. I've disabled the sa login but in Event Viewer/Application I'm getting a batch of Failure Audit messages 'Login failed for user sa'. This happens about every 40 minutes. SQL Express doesn't have an agent so I don't see how there can be regular jobs running.
Any ideas anyone?

eUK-Martin · #2 (**permalink**) 24-11-2008, 16:39

This is probably a brute force from another server to get the 'sa' password of your SQL server and to inject virus link into the database. Since you say that you have disabled 'sa' login they will not be able to hack any thing but these processes will consume server resources:

There are 2 option to overcome this problem:

1. Disable Remote SQL connection.
2. Configure Firewall or IP Sec to allow connections from know IP only.

**iminore** · #3 (**permalink**) 24-11-2008, 17:02

Thanks for that. Found the 'allow remote connections' control. It was 'enabled' but not any more. Will see if any more messages come through.

**iminore** · #4 (**permalink**) 24-11-2008, 17:40

hmm that made it worse. Now I'm getting the same messages continuously. Is it something internal to the server?